Re:Microsoft Will Switch Off Recall by Default After Securit...
by ls612 on Friday June 07, 2024 @04:47PM
(#40612794)
>Oh wait that is only for Chrome Apps. For extensions, they can literally update themselves anytime. Someone would just have to steal the certificate.
Mozilla reviews signed extension updates. Something tells me uBO is one of the most scrutinized given how very many users it has.
>If an extension that reads all data uses a CDN (like CloudFlare) that CDN can execute a MITM attack against it and download new code, that would he catastrophic even if it was caught 1 day later.
My threat model doesn't include state actors targeting me specifically. Not sure much of anything works against that threat model besides maybe iOS in Lockdown Mode as your only device.
Re:Microsoft Will Switch Off Recall by Default After Securit...
by EGreg on Friday June 07, 2024 @07:03PM
(#40613809)
Extensions can simply download and update their own code, eg by loading new stuff from localStorage.
I have seen Metamask update itself randomly, and it has access to read every website
These extensions should not store any data without a master password that you input every time.
What if someone stole the signing key, and submitted an update to Chrome store, even for a little? Oh wait that is only for Chrome Apps. For extensions, they can literally update themselves anytime. Someone would just have to steal the certificate.
If an extension that reads all data uses a CDN (like CloudFlare) that CDN can execute a MITM attack against it and download new code, that would he catastrophic even if it was caught 1 day later.